Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-22665

BuildPipelineView.MyUserIdCause stores entire hudson.model.User

XMLWordPrintable

      Since MyUserIdCause.user is not transient, the entire User object is serialized to a build record as per $JENKINS_HOME/users/*/config.xml, including dangerous things like a customized API token and credentials.

      And the class is not static, so it serializes a reference to the BuildPipelineView mentioning it.

      Example:

      <?xml version='1.0' encoding='UTF-8'?>
<build>
  <actions>
    ...
    <hudson.model.CauseAction>
      <causes>
        <au.com.centrumsystems.hudson.plugin.buildpipeline.BuildPipelineView_-MyUserIdCause plugin="build-pipeline-plugin@1.3.3">
          <userId>person@somewhere.com</userId>
          <user>
            <fullName>Some Person</fullName>
            <properties>
              <jenkins.security.ApiTokenProperty>
                <apiToken>OOPS!</apiToken>
              </jenkins.security.ApiTokenProperty>
              <com.cloudbees.plugins.credentials.UserCredentialsProvider_-UserCredentialsProperty plugin="credentials@1.9.3">
                <domainCredentialsMap class="hudson.util.CopyOnWriteMap$Hash">
                  <entry>
                    ...
                  </entry>
                </domainCredentialsMap>
              </com.cloudbees.plugins.credentials.UserCredentialsProvider_-UserCredentialsProperty>
              <hudson.model.MyViewsProperty>
                <views>
                  ...
                </views>
              </hudson.model.MyViewsProperty>
              <hudson.plugins.openid.OpenIdUserProperty plugin="openid@2.3">
                <identifiers>
                  <string>OOPS!</string>
                </identifiers>
              </hudson.plugins.openid.OpenIdUserProperty>
              ...
            </properties>
          </user>
          <outer-class reference="../user/properties/hudson.model.MyViewsProperty/views/au.com.centrumsystems.hudson.plugin.buildpipeline.BuildPipelineView[10]"/>
        </au.com.centrumsystems.hudson.plugin.buildpipeline.BuildPipelineView_-MyUserIdCause>
      </causes>
    </hudson.model.CauseAction>
    ...
  </actions>
  ...
</build>

      A Cause must be a static class with a small serial form. In this case you need only a String userId field; use User.get to retrieve the live object on demand.

      (Or just use the standard UserIdCause. It is not clear why you felt the need to subclass that.)

          [JENKINS-22665] BuildPipelineView.MyUserIdCause stores entire hudson.model.User

          Jesse Glick created issue -
          Daniel Beck made changes -
          Link New: This issue is related to JENKINS-24994 [ JENKINS-24994 ]
          Patrik Boström made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: Open [ 1 ] New: Resolved [ 5 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 154776 ] New: JNJira + In-Review [ 195021 ]

            Unassigned Unassigned
            jglick Jesse Glick
            Votes:
            8 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: